JPWO2019026137A1 - Program verification system, method and program - Google Patents

Abstract

The program verification system of the present invention includes a program execution function that is a function of executing a new program in the same environment by a command in the program to be verified, which is input as a program that operates in a secure environment. And/or external input attack protection, which is a function that protects the program to be verified or the protection mechanism of the secure environment from which it is operating, against attacks caused by data input from outside during program execution. A program verification unit 51 for verifying whether or not the function is included, and a signature unit 52 for giving a signature to the program based on the verification result by the program verification unit 51 are provided.

Description

The present invention relates to a program verification system, a program verification method, and a program verification program for preventing an attack from a malicious program in a secure environment.

2. Description of the Related Art In recent years, as a security solution for IoT, a technology called a TEE (Trusted Execution Environment) technology for realizing a safe execution environment for applications by using hardware and software has attracted attention.

As an example of TEE, the execution environment of a program or the like is separated into a normal execution environment (hereinafter referred to as a non-secure environment) and an execution environment in which a predetermined safety measure is taken (hereinafter referred to as a secure environment), and secure. The programs placed in the environment (hereinafter referred to as secure programs) are regulated, and access from the non-secure environment to the secure environment is prohibited (for example, Patent Document 1). By imposing such restrictions, confidential information and programs placed in a secure environment are protected from external attacks.

Further, for example, in Patent Document 2, the security of a code is determined in advance for a script program based on a predetermined safety policy, the code is rejected when it is not safe, and the script program is executed. It is described that the execution is prevented when a violation of the safety policy occurs.

JP, 2014-089652, A JP, 2009-521737, A

FIG. 14 is a conceptual diagram of a safe execution environment. As shown in FIG. 14, in many TEEs, a non-secure environment and a secure environment are separated, and only a secure program whose safety is guaranteed by a provider or the like is placed in the secure environment. Build a safe execution environment by prohibiting access to. Even if a malicious process (malware, etc.) is placed in the non-secure environment, the process and data in the secure environment are not attacked by it, so normal operation can be maintained.

In this way, the security of many secure programs is covered by static verification of technology and legal guarantee. However, legal deterrence such as contracts and on-boarding is unlikely to be applicable to a malicious person.

As shown in FIG. 15, once the malicious program is placed in the secure environment, it is difficult to detect the malicious program from the outside or eliminate the malicious program from the outside. This is because, like the above-mentioned TEE, it is difficult to receive external interference due to the protection mechanism of the secure environment. Therefore, no malicious intent can be seen at the time of verification, but if a secure program in which malicious intent is manifested during operation is placed, it may be unilaterally attacked. Therefore, it is important not to operate (not place or give execution permission) a secure program that may have malicious intent in the secure environment even if it is not revealed during such verification.

An example of the malicious intention that has not been revealed at the time of verification is a Drive by download attack. As shown in FIG. 16, no malicious intent is found at the time of verification before placement, but it is conceivable that a malicious secure program may be mutated by an external data input or the like in the operation process to give an attack. The example shown in FIG. 16 seems to be a program that performs communication between the terminal and the server at the time of verification, and securely holds confidential information obtained from the server in the terminal, but a malicious program at the time of operation. This is an example of mutation. In this example, a program that has been verified in advance downloads a part of malware execution data as confidential information from a predetermined server at the time of operation and uses the vulnerability of the secure program and the protection mechanism of the secure environment to download the malware. The execution data is taken into a secure program (control is passed to the execution data), etc., and mutated into malware.

Further, as shown in FIG. 17, no malicious intent is found during the verification before the placement, but it is conceivable that a malicious secure program is newly activated by an external data input or the like in the operation process to give an attack. .. The example shown in FIG. 17 seems to be a program that communicates between the terminal and the server at the time of verification, and securely holds confidential information obtained from the server in the terminal, but a malicious program at the time of operation. Is an example of downloading and starting. In this example, a program that has been verified in advance downloads malware execution data as confidential information from a specified server and files it during operation, and exploits the vulnerabilities of the secure program and the protection mechanism of the secure environment. The execution data is activated as if it were a valid execution file.

With legal deterrence, it is not possible to physically limit the behavior of a malicious attacker who intentionally deploys or executes a program that contains unidentified malicious intent. Is required. However, it is difficult to detect malicious intent or prevent attack by a method described in Patent Document 1 or Patent Document 2 with respect to a secure program whose presence or absence of malicious intent dynamically changes due to external input.

In view of the above problems, it is an object of the present invention to provide a program verification system, a program verification method, and a program verification program that can prevent malicious attacks that become apparent in a secure environment.

The program verification system according to the present invention includes a program execution function that is a function of executing a new program in the same environment by a command in the program to be verified, which is input as a program that operates in a secure environment. And/or external input attack protection, which is a function that protects the program to be verified or the protection mechanism of the secure environment from which it is operating, against attacks that result from external data input during program execution. It is characterized by comprising a program verification means for verifying whether or not the function is included, and a signature means for giving a signature to the program based on the verification result by the program verification means.

In the program verification method according to the present invention, the information processing apparatus has a function of causing a program to be verified input as a program operating in a secure environment to execute a new program in the same environment by an instruction in the program. And/or protects the protection mechanism of the program to be verified or the secure environment from which it is operating, against attacks caused by external data input during program execution. It is characterized by verifying whether the external input attack protection function, which is a function, is included, and adding a signature to the program based on the verification result.

The program verification program is a program execution function that is a function that causes a program to be verified, which is input as a program that operates in a secure environment, to execute a new program in the same environment according to an instruction in the program. And/or external input that is a function that protects the protection mechanism of the program to be verified or the secure environment that is the source of the operation from an attack caused by external data input during program execution. It is characterized in that processing for verifying whether an attack defense function is included and processing for assigning a signature to a program are executed based on the result of the verification.

According to the present invention, it is possible to prevent a malicious attack that becomes apparent in a secure environment.

It is a block diagram which shows the structural example of the program verification system 10 of 1st Embodiment. 3 is a flowchart showing an example of an operation of the program verification system 10 of the first exemplary embodiment. It is a block diagram which shows the structural example of the program verification system 10 of 2nd Embodiment. 3 is a block diagram showing a configuration example of an external input attack protection function verification unit 13. FIG. It is a flow chart which shows an example of operation of program verification system 10 of a 2nd embodiment. It is a block diagram which shows the structural example of the program verification system 10 of 3rd Embodiment. It is a flow chart which shows an example of operation of program verification system 10 of a 3rd embodiment. It is a block diagram which shows the example of application to the program execution terminal of the program verification system 10. 3 is a block diagram showing another configuration example of the program verification system 10. FIG. 10 is a flowchart showing an example of the operation of the program verification system 10 shown in FIG. 9. It is a schematic block diagram which shows the structural example of the computer concerning each embodiment of this invention. It is a block diagram which shows the outline of the program verification system 50 of this invention. It is a block diagram which shows the other structural example of the program verification system 50 of this invention. It is a conceptual diagram of a safe execution environment. It is a conceptual diagram of an unsafe execution environment (when a secure program has malicious intent). FIG. 9 is an explanatory diagram showing an example in which an unidentified malicious intention is manifested during operation during verification. FIG. 9 is an explanatory diagram showing an example in which an unidentified malicious intention is manifested during operation during verification.

Embodiment 1.
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration example of a program verification system 10 according to the first embodiment. The program verification system 10 shown in FIG. 1 includes a maliciousness verification unit 11, a program execution function verification unit 12, and a signature unit 2.

The malicious intent verification unit 11 verifies that the program to be verified does not include malicious intent. A program is a description (data) of instructions for a machine. Generally, the machine-readable form is called executable code, and the human-readable form is called source code. Also, "malicious" is a code that intentionally attacks, illegally accesses, leaks information, etc. by performing an operation different from the display or the explanation given in advance or issuing a command to the machine to perform the operation. , Use cases, operation methods, etc.

For example, the malicious intent verification unit 11 can determine whether there is malicious intent using a known method. Specifically, the maliciousness verification unit 11 may input an execution code (a set) as a program to be verified and perform an existing virus check on the execution code. In this case, the malicious intent verification unit 11 may determine that verification NG (has malicious intent) when a virus is detected, and otherwise may verify OK (no malicious intent).

Further, the maliciousness verifying unit 11 causes the program to be verified to input, for example, whether or not the user has received an explanation about a use case or an operating method from the distributor, and a confirmation result at that time, and inputs the input. The presence or absence of malicious intent may be determined based on this. In this case, the maliciousness verification unit 11 determines that the verification is NG (malicious) if the user has not received an explanation of the use case or the operation method, or if the security has not been confirmed as a result. In other cases, it may be determined that the verification is OK (no malicious intention).

Further, the maliciousness verification unit 11 inputs, for example, whether or not on-boarding with a technical contact (developer etc.) has been performed on the program to be verified and the confirmation result at that time, and based on the input. The presence or absence of malicious intent may be determined. In this case, the maliciousness verification unit 11 determines that the verification is NG (malicious) when the on-boarding is not performed, or when the security is not confirmed as a result, and in other cases, the verification is performed. It may be determined to be OK (no malicious intention).

The maliciousness verification unit 11 can also be implemented by combining a plurality of the above verification methods. In that case, the malicious intent verification unit 11 determines that verification NG (with malicious intent) if even one is unsuccessful, and verifies OK (without malicious intent) if all verifications are OK.

The program execution function verification unit 12 verifies that the program to be verified does not include the program execution function. Here, the program execution function is a function of executing a new program under the same environment (that is, under secure environment) by an instruction in the program by activating another program or itself in the program ( Code). An example of such a program execution function is an exec system call in C language.

In a secure environment, if a secure program can run a new program as a derivative, even if the secure program itself does not have malicious intent, it launches malware from the executable file generated by the secure program and attacks. It becomes possible to do. In the present embodiment, by using such data input from the outside (areas other than the secure area), it is confirmed whether or not there is a code in which a malicious program may be executed later (during operation). If such a code is present, it is determined that there is a possibility of malicious intent, and it is determined as verification NG (with a program execution function), and otherwise, it is determined as verification OK (without a program execution function). ..

An example of a method for checking the presence or absence of the program execution function is analysis by disassembly. The program execution function verification unit 12, for example, disassembles the execution code of the program to be verified, and when a system call is executed, a predetermined register (for example, an AX in which a system call number is stored) in which information of an execution destination is stored. Register) to check if a prohibited system call is called.

The signature unit 2 makes a signature based on the verification result by the maliciousness verification unit 11 and the verification result by the program execution function verification unit 12. The signature unit 2 signs the program to be verified when all the verification results are verification OK.

Next, the operation of this embodiment will be described. FIG. 2 is a flowchart showing an example of the operation of the program verification system 10 of this embodiment. In the example shown in FIG. 2, first, an input unit (not shown) inputs a program to be verified (execution code or the like) (step S101).

Next, the malicious intent verification unit 11 verifies the maliciousness of the input program to be verified (step S102). As a result of the malicious intent verification, if it is determined that there is malicious intent (Yes in step S103), the process proceeds to step S104. Otherwise (No in step S103), the process proceeds to step S105.

In step S104, the verification result is set to verification NG, that is, signature NG, and the process proceeds to step S109.

In step S105, the program execution function verification unit 12 verifies the program execution function of the input verification target program. As a result of the verification of the program execution function, if it is determined that the program execution function is present (Yes in step S106), the process proceeds to step S104, and if not (No in step S106), the process proceeds to step S107.

In step S107, verification OK, that is, signature OK is finally made, and the process proceeds to step S108.

In step S108, the signature unit 2 adds a signature to the program for which the signature is determined to be OK.

Finally, the output unit (not shown) outputs the verification result (verification OK/NG) (step S109). Here, the output unit, together with the verification result, the program to be verified (the signed program in the case of verification OK) and the details thereof in the case of verification NG (which part is NG depending on which verification method). May be output).

The signature of the present embodiment is used to determine whether or not it can be placed in the secure environment and whether or not it can be executed in the secure environment. The user or the secure environment protection mechanism, for example, places only the execution code signed by the signature unit 2 in the secure environment, and permits execution in the secure environment.

In the above example, the malicious execution verification (step S102) and the program execution function verification step S105) are performed, but the verifications are performed in any order. That is, the verification of the program execution function can be performed first, or both can be performed in parallel.

As described above, according to the present embodiment, it is determined whether or not there is a malicious intent (which has become apparent) included in the program to be verified, as well as whether or not there is a program execution function that can be one of unintentional malicious intent. , Sign only if both are confirmed secure. By using the signature when determining whether to deploy in the secure environment and whether to execute in the secure environment, not only the program including the actual malicious intent but also the malicious in itself is found in the program itself. Although it is not, it is possible to prevent in advance from being placed in a secure environment or being executed in a secure environment, a program including code that may execute a malicious program later by using data input from the outside. it can. Therefore, it is possible to prevent malicious attacks that become apparent in a secure environment.

It should be noted that the program verification system 10 can also use a program determined to have no malicious intent based on a general method as a program to be verified in the present embodiment. In that case, the maliciousness verification unit 11 can be omitted. In such a case, the signature unit 2 replaces the determination of the verification result of the maliciousness verification unit 11 with the presence or absence of a predetermined signature by a third party or the like given to the program determined to be non-malicious based on a general method. Should be determined. The same applies to other embodiments.

Embodiment 2.
Next, a second embodiment of the present invention will be described. FIG. 3 is a block diagram showing a configuration example of the program verification system 10 of the second exemplary embodiment. The program verification system 10 shown in FIG. 3 includes a maliciousness verification unit 11, an external input attack defense function verification unit 13, and a signature unit 2.

The maliciousness verification unit 11 is the same as that in the first embodiment.

The external input attack defense function verification unit 13 verifies that the external input attack defense function effectively exists as a vulnerability mitigation technique in the protection mechanism of the secure environment and the program to be verified. Here, the external input attack defense function is a function of defending against an attack (execution of malicious code, area destruction, etc.) caused by external data input (especially illegal data input) during program execution. Examples of the external input attack defense function include a stack protection function and an external code execution prevention function.

The stack protection function is a function that protects the stack against external input. Here, the stack is an area for holding data (jump destination) that affects the code to be executed next. Note that the stack protection function may be protection in advance (such as prohibition of rewriting by external input of the stack) or subsequent protection (such as stopping the program when the stack is destroyed by external input).

The external input attack defense function verification unit 13 determines whether or not the program to be verified includes a stack protection function in order to prevent, for example, an illegal code or an unexpected jump to an address (passing of control). judge. In this case, the external input attack protection function verification unit 13 determines that the verification is NG (external input attack protection function, especially no stack protection function) when the stack protection function is not included, and verifies otherwise. It may be determined to be OK (there is an external input attack protection function, especially a stack protection function).

Specifically, the external input attack defense function verification unit 13 inputs an execution code (a set) as a program to be verified, and determines whether or not a predetermined stack protection function such as a canary is implemented for the execution code. You may check In addition, the external input attack defense function verification unit 13 determines whether or not the verification target program includes, as a stack protection function, a handling function (for example, _Stack_chk_fail function ()) at the time of detecting the stack destruction. You may check.

The external code execution prevention function is a function of preventing code execution in an area (hereinafter referred to as a dynamic area) such as a stack or a heap area in which rewriting is permitted during the operation of the program. Here, rewriting to the dynamic area does not matter whether it is direct or indirect. That is, the program (more specifically, the information processing device that operates according to the program) can directly rewrite the area by directly designating the area, and the program can also indirectly rewrite based on the input from the outside. The area is also included in the dynamic area.

The external input attack defense function verification unit 13 includes, for example, an external code execution prevention function for the program to be verified or the protection mechanism of the secure environment so that an illegal code input from the outside is not executed. Determine whether or not. In this case, the external input attack defense function verification unit 13 verifies NG (external input attack defense function, particularly external code execution) when the program to be verified or the protection mechanism of the secure environment does not include the external code execution prevention function. It may be determined that there is no prevention function, and in other cases, it may be determined that the verification is OK (external input attack protection function, especially with external code execution prevention function).

Specifically, when the program to be verified is an ELF binary, the external input attack defense function verification unit 13 refers to the flag of the program header, etc., and the area declared as the dynamic area has no execution permission. You may check. In addition, the external input attack protection function verification unit 13 protects dynamic areas such as NX bit (No execute bit), DEP (Data Execution Prevention), and Exec-shield in the protection mechanism of the secure environment. It may be confirmed that a technique for preventing data execution is applied.

The following is a specific example of confirmation with respect to the protection mechanism of the secure environment that operates on Linux (registered trademark).
-Check that "NX (Ececute Disable) protection:qctive" is written in the startup log.
-Refer to the "/proc/sys/kernerl/exec-shield" file and confirm that it is "enabled".

It should be noted that the confirmation of the protection mechanism of the secure environment is preferably performed on the computer on which the protection mechanism operates. For example, the program verification system 10 may be a system that operates on a terminal (hereinafter referred to as a program execution terminal) having a secure environment in which a program to be verified is arranged. In that case, the external input attack defense function verification unit 13 of the program verification system 10 performs the external input attack defense function before the program to be verified is placed in the secure environment or before being executed after being placed in the secure environment. Verify. It should be noted that the confirmation of the protection mechanism of the secure environment is performed, for example, by a computer other than the program execution terminal being connected to the program execution terminal by remote control, or performed by the user on a computer on which the protection mechanism is operating. It is also possible to input the result and perform the operation based on it.

Further, the external input attack protection function verification unit 13 can also be implemented by combining a plurality of the above verification methods. In that case, the external input attack defense function verification unit 13 verifies OK (there is an external input attack defense function) when, for example, at least one stack protection function and at least one external code execution prevention function are included. Otherwise, verification NG (no external input attack protection function) may be used. Further, the external input attack defense function verification unit 13 may be verified OK if at least one of the stack protection function and the external code execution prevention function is included, and may be verified NG otherwise. In addition, for example, a condition for verification OK is set in advance for a combination of verification methods, and the external input attack defense function verification unit 13 determines a final condition based on the condition according to the combination of verifications to be performed. The verification OK/verification NG may be determined.

FIG. 4 is a block diagram showing a configuration example of the external input attack defense function verification unit 13. As shown in FIG. 4, the external input attack defense function verification unit 13 may include a stack protection function verification unit 131 and an external code execution prevention function verification unit 132.

The stack protection function verification unit 131 verifies the stack protection function described above. The external code execution prevention function verification unit 132 verifies the external code execution prevention function described above.

The signature unit 2 makes a signature based on the verification result by the maliciousness verification unit 11 and the verification result by the external input attack defense function verification unit 13. The signature unit 2 signs the program to be verified when all the verification results are verification OK.

Next, the operation of this embodiment will be described. FIG. 5 is a flowchart showing an example of the operation of the program verification system 10 of this embodiment. Note that steps S101 to S104 and step S109 of this example are the same as those in the first embodiment.

In the example shown in FIG. 5, when an input unit (not shown) first inputs a program to be verified (execution code or the like) (step S101), the malicious intent verification unit 11 verifies that the input program to be verified is malicious. Verification is performed (step S102). As a result of the malicious intent verification, if it is determined that there is malicious intent (Yes in step S103), the process proceeds to step S104. Otherwise (No in step S103), the process proceeds to step S115.

In step S104, the verification result is set to verification NG, that is, signature NG, and the process proceeds to step S109.

In step S115, the external input attack defense function verification unit 13 verifies the external input attack defense function with respect to the input verification target program and/or the protection mechanism of the secure environment. As a result of the verification of the external input attack protection function, if it is determined that the external input attack protection function is present (Yes in step S116), the process proceeds to step S117, and if not (No in step S116), the process proceeds to step S104. ..

In step S117, verification OK, that is, signature OK is finally made, and the process proceeds to step S118.

In step S118, the signature unit 2 adds a signature to the program for which the signature is OK.

Finally, the output unit (not shown) outputs the verification result (verification OK/NG), the signed program, the details of the verification result, and the like (step S109).

The signature of the present embodiment is also used to determine whether or not placement in the secure environment and execution in the secure environment are possible.

Further, in the above example, an example in which the malicious input verification (step S102) is followed by the external input attack defense verification step S115) is shown, but these verifications are performed in any order. That is, it is possible to verify the external input attack protection first, or to perform both in parallel. Further, as in the first embodiment, it is possible to omit malicious verification.

As described above, according to the present embodiment, it is assumed that there is an attack by external input, which is one of the unrealized malicious intentions, as well as the presence/absence of malicious intentions (which is manifested) included in the program to be verified. It is judged whether or not there is a function to prevent such an attack (external input attack protection function), and a signature is given only when safety is confirmed in both points. By using the signature when determining whether to deploy in the secure environment and whether to execute in the secure environment, not only the program including the actual malicious intent but also the malicious in itself is found in the program itself. Although it is not, it is possible to prevent in advance programs from being put in the secure environment or executed in the secure environment, which may cause malicious attacks due to external data input. Therefore, it is possible to prevent malicious attacks that become apparent in a secure environment.

Embodiment 3.
Next, a third embodiment of the present invention will be described. FIG. 6 is a block diagram showing a configuration example of the program verification system 10 of the third exemplary embodiment. The program verification system 10 shown in FIG. 6 includes a maliciousness verification unit 11, a program execution function verification unit 12, an external input attack defense function verification unit 13, and a signature unit 2. In addition, this example is an example in which the first embodiment and the second embodiment are combined.

The maliciousness verification unit 11 and the program execution function verification unit 12 are the same as those in the first embodiment. The external input attack protection function verification unit 13 is the same as that in the second embodiment.

The signature unit 2 of the present embodiment signs based on the verification result by the maliciousness verification unit 11, the verification result by the program execution function verification unit 12, and the verification result by the external input attack defense function verification unit 13. The signature unit 2 signs the program to be verified when all the verification results are verification OK.

Next, the operation of this embodiment will be described. FIG. 7 is a flowchart showing an example of the operation of the program verification system 10 of this embodiment. Note that steps S101 to S104 and step S109 of the present example are the same as those in the first embodiment, and steps S115 and S116 are the same as those in the second embodiment, so description thereof will be omitted.

In this embodiment, when a program to be verified (execution code or the like) is input, first, the maliciousness verification unit 11 verifies maliciousness with respect to the input program to be verified (step S102-). After that, the program execution function verification unit 12 verifies the program execution function of the inputted program to be verified (step S105-). After that, the external input attack defense function verification unit 13 verifies the external input attack defense function with respect to the inputted program to be verified and/or the protection mechanism of the secure environment (steps S115 to S115).

Then, in response to these results, the signature unit 2 adds a signature to the program whose signature is OK (steps S127 and S128). Specifically, if the verification results of the maliciousness verification, the program execution function verification, and the external input attack defense verification are OK, the signature unit 2 determines that the verification is OK (step S127), and verifies the verification target. A signature is added to the program (step S128).

Finally, the output unit (not shown) outputs the verification result (verification OK/NG), the signed program, the details of the verification result, and the like (step S109).

In the above example, the maliciousness verification (step S102) is followed by the program execution function verification step S105), and then the external input attack protection verification is performed, but these verifications are performed in any order. Is. Further, the program verification system 10 can also select a verification method to be executed according to, for example, a user instruction or a setting file.

As described above, according to the present embodiment, not only the presence/absence of (major) malicious intent included in the program to be verified, but also the presence/absence of a program execution function that can be one of the unintentional malicious intent and/or The presence or absence of a function that protects against an attack by external input, which is one of the malicious intentions that does not manifest, is judged, and a signature is given only when the security is confirmed by all the judged ones. By using the signature when determining whether to deploy in the secure environment and whether to execute in the secure environment, not only the program including the actual malicious intent but also the malicious in itself is found in the program itself. Although it is not, it is possible to prevent in advance from being placed in a secure environment or being executed in a secure environment, a program including code that may execute a malicious program later by using data input from the outside. it can. Therefore, it is possible to prevent malicious attacks that become apparent in a secure environment.

Further, FIG. 8 is an example in which the program verification system 10 of the present embodiment is applied to a program execution terminal. The program execution terminal 300 shown in FIG. 8 includes a secure environment 310, and in the secure environment 310, a malicious intent verification unit 11, a program execution function verification unit 12, and an external input attack defense function verification unit 13 are provided as a program verification unit 10A. In addition to including, the signature unit 2 and the placement/execution unit 3 are included.

When arranging the program in the secure environment 310 or executing the program in the secure environment 310, the arrangement/execution unit 3 determines whether or not a signature by the signature unit 2 is given, and if there is a signature, the arrangement/execution unit Execute.

Further, FIG. 9 is another example of the configuration of the program verification system 10 of the present embodiment. The program verification system 10 shown in FIG. 9 includes a source input unit 41, a determination unit 42, an external input attack defense function addition unit 43, a build unit 44, and an execution unit in addition to the elements of the program verification system 10 of the third embodiment. The code output unit 45 is provided.

The source input unit 41 inputs a source code before compilation as a program to be verified.

The maliciousness verification unit 11 and the program execution function verification unit 12 are the same as those in the first embodiment. The external input attack protection function verification unit 13 is the same as that in the second embodiment. If the execution code is required as the program to be verified in each verification, the source code is input to the build unit 44 and a series of processes including pre-compilation (preprocessing, compilation, linking, etc.) is performed to obtain the execution code. Good.

The determination unit 42 determines the verification result by the maliciousness verification unit 11, the verification result by the program execution function verification unit 12 and the verification result by the external input attack defense function verification unit 13, and if all the verification results are verification OK, the signature is obtained. As an OK, the source code is input to the build unit 44 to generate an execution code. If the execution code has already been generated, the execution code is input to the signature unit 2 to be signed. The determination as to whether the signature is OK may be the same as the determination process of the signature unit 2 of the first to third embodiments.

Further, if the result of the above determination is that the verification result by the external input attack defense function verification unit 13 is verification NG, the determination unit 42 inputs the source code to the external input attack defense function addition unit 43 to protect the external input attack defense function. Add functionality.

Further, when there is another verification method in which the verification result is verification NG, the determination unit 42 may output the fact that the verification result is verification NG and the details of these verification results.

The external input attack defense function adding unit 43 adds an external input attack defense function to the input source code. The external input attack defense function providing unit 43 additionally mounts the above-described stack protection function and external code execution prevention function on the input source code and outputs the source code. Specifically, the external input attack protection function addition unit 43 may insert a code for implementing such a stack protection function into the source code. In addition, the external input attack defense function providing unit 43, even if the external code execution prevention function is disabled in the protection mechanism of the secure environment in which the program to be verified is placed, enables it. Good.

The build unit 44 performs a series of build processes including compilation on the input source code. More specifically, the build unit 44 analyzes the input source code, converts the source code into a machine language, and generates an execution code.

The signature unit 2 attaches a signature to the execution code obtained from the source code determined to be OK by the determination unit 42.

The execution code output unit 45 outputs the execution code signed by the signature unit 2.

FIG. 10 is a flowchart showing an example of the operation of the program verification system 10 of the embodiment shown in FIG. In the example shown in FIG. 10, first, the source input unit 41 inputs the source code of the program to be verified (step S201).

Next, the maliciousness verification unit 11 verifies the maliciousness of the input verification target program (source code) (step S202). The maliciousness verification method may be the same as that in the above embodiment. As a result of the malicious intent verification, when it is determined that there is malicious intent (Yes in step S203), the process proceeds to step S204. Otherwise (No in step S203), the process proceeds to step S205.

In step S204, the build fails (error code: verification NG), the details are output, and the process ends.

In step S205, the program execution function verification unit 12 verifies the program execution function. The method of verifying the program execution function may be the same as in the above embodiment. As a result of the verification of the program execution function, if it is determined that the program execution function is present (Yes in step S206), the process proceeds to step S204, and if not (No in step S206), the process proceeds to step S207.

In step S207, the external input attack defense function verification unit 13 verifies the external input attack defense function. The method of verifying the undergraduate input attack defense function may be the same as in the above embodiment. As a result of the verification of the external input attack defense function, if it is determined that the external input attack defense function is present (Yes in step S208), the process proceeds to step S210, and if not (No in step S208), the process proceeds to step S209. ..

In this example, the determination unit 42 makes the determinations in step S203, step S206, and step S208.

In step S209, the external input attack defense function adding unit 43 adds the external input attack defense function to the input source code. Then, it returns to step S207.

In step S210, the build unit 44 analyzes the input source code and generates an execution code.

Next, the signature unit 2 gives a signature to the generated execution code (step S211).

Finally, the execution code output unit 45 outputs the execution code with the signature (step S212).

As in the configuration shown in FIG. 9, the program verification system 10 can provide not only the verification but also a missing function as a result of the verification.

8 and 9, the program verification unit 10A includes the malicious program verification unit 11, the program execution function verification unit 12, and the external input attack defense function verification unit 13 as the program verification unit 10A. The verification unit 10A may include at least the program execution function verification unit 12 and the external input attack defense function verification unit 13.

Next, a configuration example of a computer according to each embodiment of the present invention will be shown. FIG. 11 is a schematic block diagram showing a configuration example of a computer according to each embodiment of the present invention. The computer 1000 includes a CPU 1001, a main storage device 1002, an auxiliary storage device 1003, an interface 1004, a display device 1005, and an input device 1006.

Each node of the network control system of each of the embodiments described above may be implemented in the computer 1000. In that case, the operation of each node may be stored in the auxiliary storage device 1003 in the form of a program. The CPU 1001 reads the program from the auxiliary storage device 1003, expands it in the main storage device 1002, and executes the predetermined processing in each embodiment according to the program. The CPU 1001 is an example of an information processing device that operates according to a program, and in addition to a CPU (Central Processing Unit), for example, an MPU (Micro Processing Unit), an MCU (Memory Control Unit), a GPU (Graphics Processing Unit), or the like. May be provided.

The auxiliary storage device 1003 is an example of a non-transitory tangible medium. Other examples of non-transitory tangible media include magnetic disks, magneto-optical disks, CD-ROMs, DVD-ROMs, semiconductor memories, etc. connected via the interface 1004. Further, when this program is distributed to the computer 1000 via a communication line, the computer to which the program is distributed may have the program expand the program in the main storage device 1002 and execute a predetermined process in each embodiment.

Further, the program may be a program for realizing a part of the predetermined processing in each embodiment. Further, the program may be a difference program that realizes a predetermined process in each embodiment in combination with another program already stored in the auxiliary storage device 1003.

The interface 1004 exchanges information with other devices. In addition, the display device 1005 presents information to the user. The input device 1006 also receives input of information from the user.

Further, depending on the processing content in the embodiment, some elements of the computer 1000 can be omitted. For example, the display device 1005 can be omitted if the node does not present any information to the user. For example, if the node does not accept information input from the user, the input device 1006 can be omitted.

Further, some or all of the constituent elements of each device are implemented by a general-purpose or dedicated circuit (Circuitry), a processor, or a combination thereof. These may be configured by a single chip, or may be configured by a plurality of chips connected via a bus. Further, some or all of the constituent elements of each device may be realized by a combination of the above-described circuits and the like and a program.

When some or all of the components of each device are realized by a plurality of information processing devices, circuits, etc., the plurality of information processing devices, circuits, etc. may be centrally arranged or distributed. Good. For example, the information processing device, the circuit, and the like may be realized as a form in which a client and server system, a cloud computing system, and the like are connected to each other via a communication network.

Next, the outline of the present invention will be described. FIG. 12 is a block diagram showing an outline of the program verification system 50 of the present invention. The program verification system 50 shown in FIG. 12 includes a program verification unit 51 and a signature unit 52.

The program verification unit 51 (for example, the program execution function verification unit 12, the external input attack defense function verification unit 13, and the program verification unit 10A) adds the verification target program input as the program operating under the secure environment to the program concerned. Command does not include a program execution function that is a function of executing a new program in the same environment, and/or the program to be verified or the protection mechanism of the secure environment that is the operation source of the program has a program It is verified whether the external input attack protection function, which is the function to protect the attack caused by the external data input being executed, is included.

The signature unit 52 (for example, the signature unit 2) gives a signature to the program based on the verification result by the program verification unit 51.

With such a configuration, it is possible to prevent malicious attacks that are manifested in a secure environment.

FIG. 13 is a block diagram showing another configuration example of the program verification system 50 of the present invention. As shown in FIG. 13, the program verification means 51 may include a program execution function verification means 511 and an external input attack defense function verification means 512.

The program execution function verification unit 511 (for example, the program execution function verification unit 12) adds a new program under the same environment to the verification target program input as the program operating under the secure environment by the instruction in the program. Verify whether the program execution function that is the function to be executed is not included.

The external input attack defense function verification unit 512 (for example, the external input attack defense function verification unit 13) inputs an illegal data from the outside during execution of the program to the verification target program or the protection mechanism of the secure environment which is the operation source. It is verified whether the external input attack defense function, which is the function that defends against the attacks caused by, is included.

Although the present invention has been described with reference to the exemplary embodiments and examples, the present invention is not limited to the above-described exemplary embodiments and examples. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

INDUSTRIAL APPLICABILITY The present invention is suitably applicable not only to a secure environment but also to a robust execution environment.

10 program verification system 10A program verification unit 11 maliciousness verification unit 12 program execution function verification unit 13 external input attack defense function verification unit 131 stack protection function verification unit 132 external code execution prevention function verification unit 2 signature unit 300 program execution terminal 310 secure environment 3 Placement/Execution Section 41 Source Input Section 42 Judgment Section 43 External Input Attack Defense Function Adding Section 44 Build Section 45 Execution Code Output Section 1000 Computer 1001 CPU
1002 Main storage device 1003 Auxiliary storage device 1004 Interface 1005 Display device 1006 Input device 50 Program verification system 51 Program verification means 511 Program execution function verification means 512 External input attack protection function verification means 52 Signing means

Claims (10)

Whether the program to be verified that has been input as a program that operates in the secure environment does not include a program execution function that is a function to execute a new program in the same environment by an instruction in the program, and/ Alternatively, whether the program to be verified or the protection mechanism of the secure environment that is the operation source of the program includes an external input attack protection function that protects an attack caused by external data input during execution of the program. Program verification means to verify whether
A program verifying system comprising: a signature unit that adds a signature to the program based on a result of verification by the program verifying unit. The program verification means,
It is verified whether the program to be verified that is input as a program that operates in the secure environment does not include the program execution function that is a function to execute a new program in the same environment by the instruction in the program. Program execution function verification means,
Whether the program to be verified or the protection mechanism of the secure environment, which is the operation source of the program, includes an external input attack protection function that is a function of protecting an attack caused by unauthorized data input from the outside during execution of the program. Including external input attack defense function verification means for verifying whether
The signature means assigns a signature based on the verification result by the program execution function verification means and the verification result by the external input attack defense function verification means when all verification results are verification OK. The program verification system described in. The program verification system according to claim 2, wherein the program execution function verification means confirms that the program to be verified does not include a system call that causes a machine to execute a new program. The external input attack defense function verification means is that the program to be verified includes a stack protection function, or the program to be verified or the protection mechanism of the secure environment that is the operating source of the program operates. The program verification system according to claim 2, wherein the program verification system includes a function for preventing execution of code in a dynamic area, which is an area in which rewriting is permitted, which is an external code execution prevention function. The program verification system according to claim 4, wherein the external input attack defense function verification means performs verification OK when the stack protection function or the external code execution prevention function is included. The program verification system according to claim 4 or 5, wherein the stack protection function includes a posteriori protection against an external input to the stack. 7. The program verification means performs the verification at least for a program whose safety has been confirmed by a predetermined verification of pre-execution code, use case and/or operating method. The program verification system described in. Source input means for inputting the source code of the program to be verified,
External input attack function imparting means for imparting an external input attack defense function to the source code,
And a build means for converting the source code into an execution code that is a machine language,
The program verification means verifies the source code,
The external input attack function adding means adds the external input attack function when the source code does not include the external input attack function as a result of the verification by the program verifying means,
The program verification system according to any one of claims 1 to 7, wherein the signature means adds a signature to the execution code after the build by the build means based on a result of verification by the program verification means. The information processing device
Whether the program to be verified that has been input as a program that operates in the secure environment does not include a program execution function that is a function to execute a new program in the same environment by an instruction in the program, and/ Alternatively, whether the program to be verified or the protection mechanism of the secure environment that is the operation source of the program includes an external input attack protection function that protects an attack caused by external data input during execution of the program. To verify
A program verification method, wherein a signature is added to the program based on a result of the verification. On the computer,
Whether the program to be verified that has been input as a program that operates in the secure environment does not include a program execution function that is a function to execute a new program in the same environment by an instruction in the program, and/ Alternatively, whether the program to be verified or the protection mechanism of the secure environment that is the operation source of the program includes an external input attack protection function that protects an attack caused by external data input during execution of the program. A program verification program for executing a process of verifying whether or not to perform a process of assigning a signature to the program based on a result of the verification.

Images